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DETAILED ACTION 



1 . Claims 1 -20 are pending. 



Response to Arguments 

* 

2. In view of the Notice of Appeal filed on 8/29/05, PROSECUTION IS HEREBY 
REOPENED. A new grounds of rejection and rebuttal to the reply brief is set forth 
below. 

To avoid abandonment of the application, appellant must exercise one of the 
following two options: 

(1) file a reply under 37 CFR 1.111 (if this Office action is non-final) or a reply 
under 37 CFR 1.113 (if this Office action is final); or, 

(2) request reinstatement of the appeal. 

If reinstatement of the appeal is requested, such request must be accompanied by 
a supplemental appeal brief, but no new amendments, affidavits ( 37 CFR 1.130, 
1.131 or 1.132) or other evidence are permitted. See 37 CFR 1.193(b)(2). 



Claim Rejections - 35 USC § 112 
3. The following is a quotation of the second paragraph of 35 U.S.C. 112: 
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The specification shall conclude with one or more claims particularly pointing out and 
distinctly claiming the subject matter which the applicant regards as his invention. 

Claims 1-20 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for 

failing to particularly point out and distinctly claim the subject matter which applicant regards as 

the invention. 



Where applicant acts as his or her own lexicographer to specifically define a term of a 
claim contrary to its ordinary meaning, the written description must clearly redefine the claim 
term and set forth the uncommon definition so as to put one reasonably skilled in the art on 
notice that the applicant intended to so redefine that claim term. Process Control Corp. v. 
HydReclaim Corp., 190 F.3d 1350, 1357, 52 USPQ2d 1029, 1033 (Fed. Cir. 1999). The term 
"active entity" in claim 1 is used by the claim to mean "human being or legal entity", while the 
accepted meaning is "an object that performs an action" The term is indefinite because the 
specification does not clearly redefine the term. 

Applicants have argued the following (page 7, last paragraph) 

Appellents respectfully submit that the Examiner must interpret the claims in light of the 
specification and that the specification is a dictionary for the terms to be used in the 
claims. Claim 1 uses the term "active entity" and thus, it is the Examiner's duty when 
interpreting the claim to look to the specification to determine what the term "active entity" 
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encompasses. A ccording to the present specification, on active entity is a human being or legal 
entity (see page 15, lines 13-15). The specification does not state than an active "entity" is just 
any object. To the contrary, the specification clearly states than an active entity is human being 
or legal entity. 

The Examiner counters that the Examiner must interpret the claims with the "broadest reasonable 
interpretation consistent with the specification." (MPEP 21 11) and not j ust simply "in light of the 
specification". Applicant argues against the Examiner's definition of an active entity and cites 
(page 1 5, lines 13-15) as clearly stating that an active entity is a human being or legal 
entity. However, contrary to Applicant's allegations, this reference only provides an example of 
what an active entity may be. It provides no explicit definition and certainly does not preclude 
the interpretation that an active entity may be an instantiated object as the Examiner has defined 
it. 

The exact citation of page 15, lines 13-15, which applicant has cited in support of his position 
recites 

"...facto standard in Business object modeling. In particular, FIG 6. shows classes representing 
active entities like human beings or legal entities. Inheritance relationships are shown by lines 
that." 

The Examiner contends this definition is not explicit, and the Examiner cannot read these 
limitations into the claimed language. It is clear from the language the Applicant did not intend 
for the term "active entities" to be explicitly limited to human beings or legal entities. The 
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language is exemplary, and not an explicit definition. Applicant is appearing to force the 
Examiner to adopt the definition that an active entity may only be a human being or legal entity 
to satisfy the claimed language, while this restricted scope is clearly is not so confining to the 
Applicant as worded by the specification. 

Furthermore, the Applicant has had the opportunity to amend the term "active entities" into 
"human beings or legal entity" but chose not to. If the Applicant's interpretation of the term was 
limited only to "human beings or legal entities", Applicant may have amended the term as such 
without further loss of generality to the claims. Instead the Applicant has chosen to recite the 
broader term "active entities", and without explicit re-definition by the specification, the 
Examiner has interpreted the term as one of ordinary skill in the art of object oriented 
programming design would have. If Applicant desires that the term active entity is to be 
interpreted as a "human being" or "legal entity", an explicit redefinition must be given by the 
specification, and not merely the providing a several examples of what an active entity is "like". 

Furthermore, Applicant's claim 5 recites 

The method of claim 4 y wherein said providing output further comprises identifying at least one 
way in which said information-handling process could be improved. 



Applicant has argued on paragraph 2, page 14. 
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"Using CRC cards, which again are physical index cards that a programmer may use as a tool 
to understand how objects work with each other, does not provide any output that identifies at 
least one way in which an information handling process can be improved. " 

As the applicant has gathered, the use of CRC cards is to assist the programmers in gaining a 
better understanding of how the objects of their design work with one another. 

The Examiner contends that the Applicant has merely claimed a "potential". 

The claim does not recite "at least one way in which said information-handling process can 
definitively be improved" but recite "at least one way in which said information-handling process 
could be improved" 

One of ordinary skill in the art would understand that a better understanding of the objects in 
question which applicant has conceded is a tool in which a programmer may use as a tool to 
understand how objects work with each other is in fact a way in which the information handling 
process could be improved. 

Nevertheless, claim 5 is indefinite because it fails to identify the specific steps in which an 
information process could be improved. Left to itself, it would appear that any set of actions 
may be construed as having the potential to improve the information handling process, or rather 
is a method in which such a process "could" be improved. 



Further response to Arguments 
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Applicant has additionally argued: 

The basic fallacy in the Examiner 's position is that the Examiner is using a general textbook 
teaching of basic building blocks of object oriented environments and concluding that these 
general teachings necessarily obviate all possible uses and arrangements of these building 
blocks. 

The Examiner contends that this is not his position. It is the Examiner's position that insofar as 
the Applicant has recited a "structure" or particular "arrangement" of the building blocks, that 
this particular arrangement is met by Martin. The Applicant has recited a "structure" or 
"arrangement" of these blocks in broad terms. 

Claim 1 recites as follows: 

A method in a data processing system, for handling personally identifiable information, said 
method comprising: 

Providing in a computer, a first set of object classes representing active entities in an 
information-handling process, wherein a limited number of privacy-related actions represent 
operations performed on data. 

Providing in said computer, a second set of object classes representing data and rules in said 
information-handling process, wherein at least one object class has said rides associated with 
said data, and wherein said data represents said personally identifiable information; 
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Processing transactions, in the data processing system, involving said personally identifiable 
information, using said computer and said first and second set of object classes, so as to enforce 
a privacy policy, associated with the personally identifiable information and defined by said 
rules, against one or more active entities represented by said first set of object classes. 

The Examiner contends however that as far as claim 1 is specific about the arrangement of 
particular objects, classes, and rules, Martin recites these limitations. 

The Examiner contends that claim 1 provides no substantial "arrangement" or "structure" or 
"manipulation" that would not have been obvious to one of ordinary skill in the art in view of 
Martin. 

For example, Applicant's claim 1 recites: "providing" "in a computer" a first set of object 
classes. It is evident that the whole purpose of Martin is to provide insight in how these object 
classes may be created for their eventual implementation on the computer. 

Martin discloses a first set of object classes of object classes on (pages 23-24, " What is a 
class") In this sense, Martin can be construed to be "providing" these elements. 

It is not the Examiner's position that a general teaching of the building blocks of object oriented 
environments obviates all possible uses and arrangements of these building blocks. It is however, 
the Examiner's position that Martin discloses the "arrangement" of these building blocks as far 
as the Applicant has defined it in claim 1 . 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 1 02 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

5. Claims 1-20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Martin, 
"Principles of Object Oriented Analysis and Design" (hereafter Martin). 

In reference to claim 1 : 

(Martin, "Principles of Object Oriented Analysis and Design") discloses a method for handling 
personally identifiable information, said method comprising: 

• Providing in a computer a first set of object classes, where object classes are classes that 
are later to be instantiated into objects, (pages 23-24, "What is a Class?") 

• Representing active entities in an information-handling process, wherein a limited 
number of privacy-related actions represent operations performed on data, where the 
active entities are the objects themselves, and the privacy related actions-representing 
operations performed on data are the operations used to read and manipulate data of the 
object, (page 19, "operations") 

• Providing in said computer a second set of object classes representing data and rules in 
said information-handling process, wherein at least one object class has said rules 
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associated with said data, and wherein said data represents said personally identifiable 
information, where objects are capable of representing data and rules in their 
interrelationships with other objects, (page 144, "Object Structure Analysis/ Object 
Behavior Analysis") 

• Processing transactions, in the data processing system, involving said personally 
identifiable information, using said computer and said first and second set of object 
classes, associated with personally identifiable information and defined by said rules, 
against one or more active entities represented by said first set of object classes, where 
transactions are performed in the interactions of the objects between one another, and the 
examples of personally identifiable information are who the customers are, their salaries, 
and the employee type, (page 146-147, Diagrams). 

Martin fails to explicitly disclose a method wherein the first and second set of object classes 
enforce a policy. 

Birnbaum( Abstract) discloses "Policies are defined to be rules for the values of the attributes of 
managed objects." (Column 2, lines 14-26) & (Column 2, lines 40-45) 
Birnbaum (Column 5, lines 25-40) discloses that the policies used for objects and classes may 
comprises classes which represent people or employees within an organization. 

Birnbaum has described policies to the set of rules governing objects and their attributes. 
Birnbaum additionally teaches that in particular a "privacy policy" or policies to which rules 
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governing the security, and access of resources for objects may be given, are advantageous in 
that they help insure the security of accountability of a resource and the context in which they 
may be used. (Column 6, lines 33-49) 

It would have been obvious to one of ordinary skill in the art to have the set of object classes for 
Martin enforce a privacy policy in order to secure the accountability of the object resources. 

In reference to claim 2: 

(Martin, "Principles of Object Oriented Analysis and Design") discloses the method of claim 1, 
wherein said object classes include one or more object classes representing parties, selected from 
the group consisting of 

• A data user object class, where the student is the data user object class. (Page 158) 

• A data subject object class, where the subject object class is the class, (page 158) 

• A guardian object class, where the guardian object class is a stock withdrawal subsystem, 
(page 1 94) 

• A privacy authority object class, where the privacy authority class is a server class, (page 
192) 



In reference to claim 3 : 
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(Martin, "Principles of Object Oriented Analysis and Design") discloses the method of claim 1, 
wherein said at least one object class, having said rules associated with said data, (page 144, 
"Object Structure Analysis/ Object Behavior Analysis") 

(Martin, "Principles of Object Oriented Analysis and Design") fails to explicitly disclose 
representing the rules as a filled paper form, including both collected data and rules regarding 
said collected data. 

(Martin, "Principles of Object Oriented Analysis and Design") does however disclose that rules 
may be written in the English Language, (page 133-134, "Rules Expressed in English"). Martin 
discloses more rules on pages (138-139, Box 10.1 & 10.2) 

The Examiner takes official notice that representing the rules as a filled paper form, including 
both collected data and rules regarding said collected data was well known in the art at the time 
of invention. An example of this is a contract signed by certain parties. 

It would have been obvious to one of ordinary skill in the art at the time of invention to collect 
rules as a filled paper form. 



In reference to claim 4: 
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(Martin, "Principles of Object Oriented Analysis and Design") discloses the method, in a data 
processing system, for improving the handling of personally identifiable information, said 
method comprising: 

• Performing, in the data processing system, an initial assessment of an information 
handling process, where the initial assessment is the analysis of the system to be modeled 
in an Object oriented process, (pages 59-60, "Models of Reality") 

• Constructing, in said data processing system, a model of said information handling 
process, based on said initial assessment, where the model of said information handling 
process is performed once an analysis has been made, (pages 59-60, "Models of 
Reality") 

• Providing output, from said data processing system, based on said initial assessment and 
constructing, that identifies at least one way in which said personally identifiable 
information could be better handled, where a particular technique in the refinement of the 
object model is the practice of using CRC cards to gain a better understanding about how 
to handle the model at hand. (Pages 187-190, "Responsibility driven design") 

• Wherein said constructing includes: 

• Representing entities, data, and rules in said information handling process by using a 
limited number of object classes, where objects represent entities, where the data are 
attributes of objects, and where rules are functions that typify the interaction between 
objects, (page 156, "models and diagrams") & (page 140, center diagram, 146-147, 
Diagrams) & (page 166) 
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• Representing operations performed on data by using a limited number of privacy-related 
actions, where the active entities are the objects themselves, and the privacy related 
actions-representing operations performed on data are the operations used to read and 
manipulate data of the object, (page 19, "operations") 

• Representing transactions by using said limited number of object classes and said limited 
number of privacy-related actions, where the transactions are interactions between the 
modeled objects, (Page 118, "Events triggers and Operations") and the request for data is 
a privacy related action, (page 19, "operations") 

The Examiner notes that Applicant has defined what privacy related actions are in the 
specification. On page 19 of the specification, Applicant defines some privacy related actions 
including "access" to grant access to read the user's information. For this reason, the Examiner 
has defined similar operations in Martin as "privacy related actions" 

In reference to claim 5: 

(Martin, "Principles of Object Oriented Analysis and Design") discloses the method of claim 
wherein said providing output further comprises identifying at least one way in which said 
information-handling process could be improved, where a particular technique in the refinement 
of the object model is the practice of using CRC cards to gain a better understanding about how 
to handle the model at hand. (Pages 187-190, "Responsibility driven design") 



In reference to claim 6: 
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(Martin, "Principles of Object Oriented Analysis and Design") discloses the method of claim 4, 
wherein said providing output further comprises identifying at least one way to improve 
compliance with a law or contract, where the CRC method is a technique for better identifying 
responsibilities of the objects(page 188, "responsibilities and collaborators"), and it is known in 
the art that groups responsibilities are contracts, (page 191, "contracts") 

Claims 7, 9 are rejected for the same reasons as claim 5. 

In reference to claim 8: 

(Martin, "Principles of Object Oriented Analysis and Design") discloses the method of claim 4, 
further comprising designing a modification to said information-handling process, based on said 
constructing and providing, where modifications are constantly being designed in the creation of 
the object oriented model of the system from the creation of the model, to the creation of its 
design, to the generation of the code, (page 60) 

Claim 10, 13, 16 are rejected for the same reasons as claim 2. 
Claims 12, 15 are rejected for the same reasons as claim 1. 
Claims 11, 14, 17 are rejected for the same reasons as claim 3. 

In reference to claim 18: 

(Martin, "Principles of Object Oriented Analysis and Design") (page 166) discloses the method 
of claim 1, wherein: 
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A first active entity represented by a first object class in said first set of object classes is a first 
data user that requests said personally identifiable information from a data subject, where a first 
active entity is a student, represented by a person object (Figure 11.13 description) that requests 
personally identifiable information from a data subject, where the personally identifiable 
information is a registration. 

In reference to claim 19: 

(Martin, "Principles of Object Oriented Analysis and Design") (page 166) discloses the method 
claim 18, further comprising: transforming, based on said rules, said personally identifiable 
information into a depersonalized format prior to providing said personally identifiable 
information to the second data user, where the registration information is in a depersonalized 
format, but is specific to a particular student when a student makes that registration. 

Claim 20 is substantially similar to claim 12 and is rejected for the same reasons. 



Conclusion 

4. Any inquiry concerning this communication from the examiner should be directed to 
Thomas M Ho whose telephone number is (703)305-8029. The examiner can normally be 
reached on M-F from 8:30 AM - 5:00 PM 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
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Gregory A. Morse can be reached on (703)308-4789. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703)746-7239 for regular 
communications and (703)746-7238 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding should 
be directed to the receptionist whose telephone number is (703)306-5484. 

TMH 

December 12 th , 2005 




